ExportEngine_APT41_Loader_Prefix.yar

import "pe"
rule ExportEngine_APT41_Loader_Prefix
{
	meta:
		author = "@stvemillertime"
		description = "This looks for a common APT41 Export DLL name in BEACON shellcode loaders, such as loader_X86_svchost.dll"
	strings:
		$pcre = /loader_[\x00-\x7F]{1,}\x00/
	condition:
		uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and $pcre at pe.rva_to_offset(uint32(pe.rva_to_offset(pe.data_directories[pe.IMAGE_DIRECTORY_ENTRY_EXPORT].virtual_address) + 12))
}